Potential system hack!? : Strange banner on login page in Russian

My YunoHost server

Hardware: AMD64 VM (Google compute engine) hosted in Iowa USA.
YunoHost version: 4.2.5.2 (stable)
I have access to my server : Yes, both frontend and backend.
Are you in a special context or did you perform some particular tweaking on your YunoHost instance ? : no /

Description of my issue

Hi,

I saw a strange banner today on my Yunohost portal page in Russian that said “Пожалуйста, войдите”. While this in English means “Please login”, but I don’t speak Russian and never selected that as an option. Even the server is a Google Cloud hosted in the US.

I am wondering whether this is an innocuous bug or something that indicates that the system is compromised. Could someone from the core team please check the code and clarify?

Thanks,
AJ

If you are able to go in development tools of your web browser, you can watch the network part and search/trigger a request to the portal.

We need your “Accept-Language” HTTP header for request made to the webportal to understand the issue.

Which web browser do you use ? Have you specific modules ? Which langage are set in your web browser (In firefox : Hamburger menu > Settings > Language)

I think it’s probably a privacy module that send different accept language however i am not sure.

1 Like

Hi Ijf,

Thanks for the message. The message didn’t appear yet after showing up once and I refreshed the page. The current network activity looks normal (screenshot below).

I am using Brave (based on Chromium) and I only have English (US) as the installed and selected language. I am not able to find the “Accept-Language” header using the developer tools. Could you please share how to find it so that I can share it here?

I am fine with closing the discussion as long as this is not of grave concern to the yunohost community.

You can find the accept language, by clicking on one of those line, a panel open, and list all information sent by the request (you have request header and response header. The Accept language is in request header.

Thanks, Valentin. It is en-US only.

EDIT from ljf: remove the image containing a hash

The content of accept language is:

en-US,en;q=0.9

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.